Major Exchange resumes BTC withdrawals after breach

TLDR

Crypto exchange Bitget has restarted Bitcoin (BTC) withdrawals after a roughly $388 million security breach, beginning a phased restoration of services.

1. The Sept 24 exploit moved about $387.5 million from Bitget hot wallets; BTC withdrawals on the Bitcoin network resumed at 08:00 UTC on 28 Sep.
2. Bitget says user balances are intact and a $464 million protection fund plus 127% reserves will absorb losses while ETH, USDT and other assets reopen in stages.
3. The attacker is still moving funds via THORChain, so users and the wider market should watch ongoing security updates, chain-specific withdrawal timelines, and any signs of renewed disruption.

Deep Dive

1. Breach And BTC Restart

Bitget suffered a security incident on 24 Sep in which attackers exploited a flaw in a third-party security product to obtain high-level internal credentials and issue fraudulent withdrawal commands from hot and warm wallets, moving about $387.5 million in crypto to attacker-controlled addresses, while cold wallets remained intact according to Bitgets account and reports such as this incident summary.

Following a full withdrawal halt, the exchange began a phased resumption on 28 Sep, reopening BTC withdrawals on the Bitcoin network (and BNB Smart Chain) at 08:00 UTC as detailed in its phased resumption schedule.

ETH withdrawals across major EVM chains are scheduled for 29 Sep, USDT on 30 Sep, with remaining assets, fiat withdrawals and P2P services targeted for early October.

2. User Impact And Protections

Bitget has repeatedly stated that user balances and private keys were not compromised and that trading and deposits continued during the withdrawal pause, while losses from the hack will be covered by its User Protection Fund, which holds over $464 million and showed about 127% reserve coverage in a recent fund disclosure.

The exchange is restoring withdrawals chain by chain after each network completes repairs and security validation, and has emphasized that there is no priority channel for VIPs or staff, with all users treated under the same conditions as outlined in its uniform access notice.

Internally, Bitget reports isolating affected systems, invalidating and reissuing credentials, tightening permission controls, and adding multi-approval plus independent verification for withdrawals to reduce the chance of similar incidents recurring.

3. Ongoing Risks To Watch

The attacker continues to move stolen assets, including swapping ETH for BTC via THORChain, as noted in on-chain analyses covered by Cointelegraph, which complicates recovery efforts and highlights the limits of protocol-level blacklisting.

Bitget is working with firms such as Mandiant and SlowMist, and has published attacker addresses and offered bounties for freezing or recovering funds, but large stolen balances in ETH, XRP, ZEC and stablecoins remain a potential overhang if liquidation attempts hit thin venues.

For the broader market, the key watchpoints are: whether further technical details reveal deeper systemic issues, whether other exchanges report related exploits, and whether regulators or major issuers tighten standards around custody, third-party security products and proof-of-reserves.

Conclusion

Bitgets decision to resume BTC withdrawals while keeping a phased schedule for other assets signals that the immediate vulnerability has been contained, but it also underscores how much trust users place in centralized infrastructure. If the investigation confirms that losses are fully absorbed by protection funds and no further unauthorized transfers occur, market impact may stay limited; if new issues emerge, venue risk and custody practices could move back into the spotlight for crypto users and regulators alike.